Ivanti has released an emergency security advisory for CVE-2026-104935 (CVSS score 9.8, Critical), a pre-authentication remote code execution vulnerability impacting Ivanti Connect Secure (ICS) and Ivanti Policy Secure (IPS) gateway appliances. The flaw allows unauthenticated remote attackers to send specially crafted SAML assertions that trigger memory corruption in the appliance's public web authentication endpoint, allowing full root takeover of the gateway.
Executive Threat Summary & Exploit Landscape
Ivanti Connect Secure (formerly Pulse Connect Secure) is deployed globally at corporate network perimeters to provide secure remote access and zero-trust network architectures. Edge VPN devices have become premier targets for advanced persistent threat (APT) groups due to their direct internet exposure and privileged placement bridging external traffic directly into internal corporate LANs.
Under CVE-2026-104935, an adversary targeting the SAML identity provider federation endpoint can execute arbitrary shell commands without possessing valid user credentials or passing multi-factor authentication. Compromising the VPN gateway grants access to active user session tokens, internal directory service bindings (Active Directory / LDAP), and unencrypted enterprise network traffic passing through the tunnel.
Vulnerability Mechanics & Technical Root Cause (CWE-287, CWE-120)
The vulnerability exists within the SAML Single Sign-On handler /dana-na/auth/saml-sso.cgi. When an unauthenticated user initiates SAML authentication, the gateway parses incoming Base64-encoded XML SAML responses. A memory boundary calculation error in the XML attribute signature verification parser allows an oversized Assertion attribute to overwrite adjacent stack frame pointers:
POST /dana-na/auth/saml-sso.cgi HTTP/1.1
Host: vpn.enterprise.com
Content-Type: application/x-www-form-urlencoded
Content-Length: 2048
SAMLResponse=PHNhbWxwOlJlc3BvbnNlIHhtbG5zOnNhbWxwPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6cHJvdG9jb2wi...
[Malformed XML Assertion Attribute Overwriting CGI Stack Frame]When the stack frame return address is hijacked, control flow diverts into shellcode stored within the HTTP payload buffer. Because the CGI process runs with elevated root privileges inside the FreeBSD/Linux underlying runtime, the adversary achieves instantaneous arbitrary system execution.
Vulnerable Software Versions & Patch Status Matrix
| Appliance Platform | Vulnerable Versions | Patched Release | Remediation Urgency |
|---|---|---|---|
| Ivanti Connect Secure (ICS) | 22.1R1 through 22.7R2.1 | 22.7R2.2, 22.7R3 | Immediate Critical |
| Ivanti Connect Secure Legacy 9.x | 9.1R1 through 9.1R18.x | Upgrade to 22.7R2.2+ | Immediate Critical |
| Ivanti Policy Secure (IPS) | 22.1R1 through 22.7R2.1 | 22.7R2.2 | Immediate Critical |
| Ivanti Neurons for ZTNA | Cloud-managed Gateways < 22.7R2.2 | Auto-updated in Cloud Controller | Cloud Remediated |
Step-by-Step Remediation Playbook & Patch Commands
Administrators of Ivanti Connect Secure must execute the following emergency update sequence:
- Download Official Package: Log into the Ivanti Community portal and download the official update service package (e.g.,
ps-ics-sa-22.7r2.2-b3481-package.pkg). - Upload Package via Admin Console:
- Navigate to Maintenance > System > Upgrade/Downgrade.
- Under Install Service Package, browse to select the downloaded
.pkgfile. - Click Install. The appliance will verify package signatures, reboot, and apply kernel updates.
- Run Integrity Checker Tool (ICT): Before and after applying updates, download and execute the latest Ivanti Integrity Checker Tool to verify no backdoor files or rogue webshells exist in the file system:
# Execution via admin console maintenance terminal Maintenance -> Troubleshooting -> Integrity Checker Tool # Confirm that status returns "System integrity is clean" - Credential Rotation: If unpatched devices were accessible to the public internet, revoke and reissue all SAML signing certificates, device certificates, and administrative passwords.
Threat Detection, Log Auditing & Forensic Queries
Search gateway event logs and reverse proxy telemetry for anomalous POST requests directed at SAML endpoints:
# Search appliance syslog export for saml-sso.cgi segmentation faults
grep -E "saml-sso.cgi.*(SIGSEGV|signal 11|core dumped)" /var/log/messages
# Inspect reverse proxy logs for unusually large POST requests to SAML handlers
awk '$7 ~ //dana-na/auth/saml-sso.cgi/ && $10 > 10000 { print $1, $4, $7, $10 }' /var/log/nginx/vpn_access.logIsolate any gateway showing abnormal outbound SSH, HTTPS, or DNS tunneling connections to untrusted foreign IP addresses.
